How severe is CVE-2025-0112?

CVE-2025-0112 has a CVSS 4.0 base score of 6.8, rated medium severity.

Is CVE-2025-0112 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-0112?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-0112 have an EU (EUVD) identifier?

Yes. CVE-2025-0112 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4639.

When was CVE-2025-0112 published?

CVE-2025-0112 was published on 2025-02-20 and last updated on 2026-06-17.

CVE-2025-0112

CVE-2025-0112 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-754.

Key facts

Severity: Medium (CVSS 4.0 base score 6.8)
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-4639
Weakness: CWE-754
Published: 2025-02-20
Last modified: 2026-06-17

Description

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity.

Frequently asked questions

What is CVE-2025-0112?: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity.
How severe is CVE-2025-0112?: CVE-2025-0112 has a CVSS 4.0 base score of 6.8, rated medium severity.
Is CVE-2025-0112 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-0112?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-0112 have an EU (EUVD) identifier?: Yes. CVE-2025-0112 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4639.
When was CVE-2025-0112 published?: CVE-2025-0112 was published on 2025-02-20 and last updated on 2026-06-17.

References

https://security.paloaltonetworks.com/CVE-2025-0112

Other CWE-754 (Improper Check for Unusual or Exceptional Conditions) vulnerabilities

CVE-2026-24054 — Critical (CVSS 10.0): Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs)…
CVE-2021-0211 — Critical (CVSS 10.0): An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing…
CVE-2026-8091 — Critical (CVSS 9.8): Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150,…
CVE-2024-52316 — Critical (CVSS 9.8): Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta…
CVE-2024-7826 — Critical (CVSS 9.8): Improper Check for Unusual or Exceptional Conditions vulnerability in Webroot SecureAnywhere - Web Shield on Windows,…
CVE-2023-37303 — Critical (CVSS 9.8): An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to…

Browse all CWE-754 (Improper Check for Unusual or Exceptional Conditions) vulnerabilities →